It appears that changes to access control entries are not always visible right away; in particular not to the session that caused them.
EntryCollectorTest has recently been extended to run the existing set of tests under load as well, and occasionally we see tests failing because of ACEs not yet being returned.
Increasing the load (see attached patch for the test) seems to make it easier to reproduce.
The underlying reason might be that this involves multiple sessions to be in sync.
Note that the cache in CachingEntryCollector doesn't seem to be the cause; disabling it by commenting out all write operations to the cache (making everything a cache miss) doesn't change the outcome.